code-video

Pass

Audited by Gen Agent Trust Hub on Nov 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies heavily on system tools for media manipulation. Multiple scripts (scripts/tts.py, scripts/sync_check.py, scripts/audio_check.sh, scripts/check_video.sh, and scripts/contact_sheet.sh) invoke ffmpeg and ffprobe via subprocess calls to encode video, extract audio, and validate media properties. These operations are consistent with the skill's primary function of video production.
  • [EXTERNAL_DOWNLOADS]: Several dependencies listed in requirements.txt involve network access:
  • edge-tts connects to Microsoft's speech platform (speech.platform.bing.com) to generate narration.
  • faster-whisper is configured to download pre-trained machine learning models from official Hugging Face repositories (Systran/faster-whisper-base.en, Systran/faster-whisper-small) for transcription and verification tasks.
  • [DYNAMIC_EXECUTION]: The rendering pipeline in scripts/capture.mjs utilizes dynamic execution to capture video frames:
  • It spawns a local HTTP server on a random loopback port (127.0.0.1) to serve the project files, with built-in path-traversal protection ensuring only the designated project directory is accessible.
  • It uses headless browser automation (Playwright or Puppeteer) to load the project and executes user-defined rendering code via page.evaluate, which is the intended mechanism for frame-by-frame capture.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 12, 2026, 10:20 AM